Data Processing Addendum

The Customer is generally the Controller and BizwardBox the Processor for Customer personal data processed to provide contracted services. BizwardBox may separately be a Controller for its own billing, security, legal, account and service-management processing.

Processing covers operation of the BizwardBox platform and related services for the contract term and limited post-termination period required to return or delete data.

Processing may include storage, organisation, retrieval, analysis, transmission, lead management, CRM, marketing automation, communications, virtual reception, reporting, AI-assisted analysis and deletion, according to Customer instructions.

Names, contact details, business details, communications, appointments, leads, website interactions, marketing information, account data and other personal data supplied by the Customer. Special-category data should not be entered unless expressly agreed and appropriately assessed.

Customer employees, contractors, customers, prospects, suppliers, website visitors and other individuals whose data the Customer lawfully provides.

BizwardBox will process personal data only on documented Customer instructions unless UK law requires otherwise. The Customer is responsible for ensuring instructions and processing purposes are lawful.

Authorised personnel are subject to confidentiality obligations. BizwardBox will maintain appropriate technical and organisational security measures proportionate to processing risk.

BizwardBox may use approved sub-processors for hosting, AI, communications, payments, analytics, security and other services. Sub-processors must be subject to appropriate contractual data-protection obligations. A current sub-processor register will be maintained and made available to Customers on request.

Taking account of the nature of processing, BizwardBox will reasonably assist the Customer with data-subject rights, security, breach response, DPIAs and regulatory consultation where required.

BizwardBox will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data, subject to legal restrictions.

Core production data is intended to remain in the UK. If a restricted transfer is required, an applicable UK GDPR transfer mechanism and safeguards will be used, such as UK adequacy regulations, the UK IDTA, the UK Addendum to EU SCCs or another lawful mechanism.

At Customer choice and subject to legal retention requirements, BizwardBox will return or delete Customer personal data following termination within a reasonable period.

BizwardBox will make reasonably necessary compliance information available. Audits must be proportionate, confidential and scheduled to minimise disruption and security risk.

The Customer remains responsible for lawful bases, privacy notices, consent, data quality, marketing compliance and lawful configuration and use of BizwardBox.

If this DPA conflicts with the Terms of Service concerning data protection, this DPA takes precedence to the extent necessary to resolve the conflict.

BizwardBox intends to provide a UK-first data-residency model. Core customer application data will be hosted in the UK where the selected infrastructure and configuration support this.

AI, email/SMS, payment, analytics, monitoring and other integrated services may process or access information outside the UK. BizwardBox will verify each production component before making an unconditional UK-only processing claim.

BizwardBox maintains a live register containing provider, service, purpose, data categories, processing location, controller/processor role, transfer mechanism, security and DPA status, and review date. This is available to Customers on request.

Before Customer personal data is sent to an AI provider, BizwardBox assesses retention, training and model-use policies, sub-processors, processing locations, security, deletion, contract terms and international transfer arrangements.

BizwardBox makes the current sub-processor register available to Customers and communicates material changes in accordance with this DPA.

BizwardBox maintains records of processing where required, security policies, retention schedules, incident procedures, access controls and DPIAs for processing likely to create high risk.